AZ-104 Manage Azure Identities and Governance Practice Question
A user is assigned the Reader role on a resource group named RG1. Later, a new storage account is created in RG1. What access will the user have to that storage account without any new role assignment?
⚠ Common exam trap
The trap here is that candidates mistakenly believe RBAC assignments do not apply to resources created after the assignment, confusing Azure RBAC with classic deployment model permissions or assuming inheritance is only for existing resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reader access, because the resource group assignment is inherited by the storage account.
Azure RBAC permissions assigned at a resource group scope are inherited by all resources within that resource group, including resources created after the assignment. Since the user has the Reader role on RG1, that role is inherited by the new storage account, granting read-only access to it without any additional role assignment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No access, because RBAC assignments do not apply to resources created later.
Why it's wrong here
This misunderstands Azure RBAC inheritance. Role assignments at a resource-group scope are inherited by every existing or future resource in that group, because authorization is evaluated against the resource's effective permissions at access time, not at deployment time. Since the Reader assignment on rg1 remains in effect, the storage account created later gets the same read-only permission set.
When this WOULD be correct
This option would be correct if the question stated that the role assignment was made at the subscription level and the storage account was in a different subscription, or if the role assignment was explicitly scoped to the resource group but the storage account was created in a different resource group.
- ✓
Reader access, because the resource group assignment is inherited by the storage account.
Why this is correct
This is correct because Azure RBAC permissions flow downward from the assigned scope. A role assigned at the resource group level applies to all current and future resources in that group unless a more restrictive condition or deny assignment applies. The new storage account automatically inherits the Reader permissions from RG1, so the user can view it without another assignment.
- ✗
Contributor access, because storage accounts inherit the highest available permissions.
Why it's wrong here
RBAC roles are not hierarchical, and child resources do not automatically receive the 'highest' role from a parent scope. The user has only the Reader role assigned at rg1, and because that role definition confines access to read-only actions, the storage account inherits exactly that same Reader permission set—no Contributor rights appear. Inheritance propagates the assigned role, not a maximized or upgraded version of it.
When this WOULD be correct
If the user had been assigned the Contributor role on the resource group, then any new resource created in that group would inherit Contributor access, making this option correct.
- ✗
Owner access, because resource group permissions always become full control on child resources.
Why it's wrong here
Azure RBAC inheritance does not transform or escalate permissions; a child resource receives exactly the same role assignments that apply at the parent scope. Because the user was assigned Reader, not Owner, on rg1, the storage account is subject only to Reader's read-only actions—Owner's privileged operations such as delegating access or deleting the resource are not granted by inheritance.
When this WOULD be correct
If a user is assigned the Owner role on a resource group, they have full control over all resources in that group, including new ones, because Owner includes all permissions and can delegate access. This would be correct in a question where the assigned role is Owner, not Reader.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Reader access, because the resource group assignment is inherited by the storage account.Correct answer▾
Why this is correct
This is correct because Azure RBAC permissions flow downward from the assigned scope. A role assigned at the resource group level applies to all current and future resources in that group unless a more restrictive condition or deny assignment applies. The new storage account automatically inherits the Reader permissions from RG1, so the user can view it without another assignment.
✗No access, because RBAC assignments do not apply to resources created later.Wrong answer — click to see why▾
Why this is wrong here
RBAC assignments on a resource group are inherited by all resources within that group, including those created after the assignment, so the user would have Reader access to the new storage account.
★ When this WOULD be the correct answer
This option would be correct if the question stated that the role assignment was made at the subscription level and the storage account was in a different subscription, or if the role assignment was explicitly scoped to the resource group but the storage account was created in a different resource group.
Why candidates choose this
Candidates may mistakenly believe that RBAC assignments are static and do not apply to resources created after the assignment, confusing RBAC with Azure Policy or resource locks.
✗Contributor access, because storage accounts inherit the highest available permissions.Wrong answer — click to see why▾
Why this is wrong here
The Reader role only allows read access, not write access. Contributor access requires a role assignment that includes write permissions, which is not inherited from the Reader role.
★ When this WOULD be the correct answer
If the user had been assigned the Contributor role on the resource group, then any new resource created in that group would inherit Contributor access, making this option correct.
Why candidates choose this
Candidates may mistakenly believe that permissions escalate for child resources or that storage accounts automatically grant higher access due to their nature.
✗Owner access, because resource group permissions always become full control on child resources.Wrong answer — click to see why▾
Why this is wrong here
The Reader role on a resource group grants read-only access to all resources within it, including new resources, but does not grant Owner or full control. Owner access requires an explicit role assignment at the resource or higher scope.
★ When this WOULD be the correct answer
If a user is assigned the Owner role on a resource group, they have full control over all resources in that group, including new ones, because Owner includes all permissions and can delegate access. This would be correct in a question where the assigned role is Owner, not Reader.
Why candidates choose this
Candidates may mistakenly believe that resource group-level permissions always escalate to full control on child resources, confusing the Reader role with higher-privileged roles like Owner or Contributor.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Role assignment
Role assignment is the process of granting a specific set of permissions to a user, group, or service principal so they can perform certain actions within a system.
Key term
Reader role
A Reader role is a predefined set of permissions in identity and governance systems that allows a user to view resources and data but not create, modify, or delete anything.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.